View original (French)

Unwanted invisible audio ad

Solved
tété37 Posted messages 15 Status Member -  
tété37 Posted messages 15 Status Member -
Hello,

I am on Windows 10, and invisible audio ads occasionally start up.
I ran a ZHPDIAG scan if needed...

https://pjjoint.malekal.com/files.php?id=20180905_v13u14c6e11e7

Another thing I just noticed... there are a hundred "Arris" processes running in my task manager!!!

Thank you for your responses.

13 answers

  1.
    tété37 Posted messages 15 Status Member 28
     
    It sounds good to me! A thousand times thank you for your help.
    1
  2. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
     
    Hello,

    To check the computer, I invite you to perform this FRST analysis and return the reports:

    Follow the FRST tutorial. ( take the time to read carefully - everything is well explained ).

    Download and run the FRST scan,
    Wait for the scan to finish, a message will indicate that the analysis is complete.

    Three FRST reports will be generated:
    • FRST.txt
    • Shortcut.txt
    • Additionnal.txt


    Send these 3 reports to the website https://pjjoint.malekal.com/ to share them.
    In return, give the 3 pjjoint links that lead to the reports here in a new response so we can consult them.

    --
    Please press any key to continue the disinfection...
    0
  4. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
     
    CCleaner is not really useful, even though it is recommended everywhere.
    If you want to keep it, disable CCleaner monitoring, which is unnecessary, as it starts with Windows and slows it down with its incessant cleaning. See: https://www.malekal.com/supprimer-ccleaner-demarrage-windows/

    Here is the correction to perform with FRST. You can refer to this explanatory note with screenshots.
    Restart FRST and then press the CTRL + Y keys on your keyboard.
    The notepad will open, copy/paste this. 

    CreateRestorePoint:
    CloseProcesses:
    Task: {DBF530B7-1DDD-4D8F-AAB5-F3A4D10F2568} - System32\Tasks\shetlandsshetlands => C:\Program Files (x86)\Haughton\paks.exe
    Task: {FDCD4FE4-4A98-49B3-9302-289617D844F5} - System32\Tasks\legionnaireslegionnaires => C:\Program Files (x86)\lecithin\lecithin.exe
     HKU\S-1-5-21-1625057639-2038213345-3322359030-1001\...\Run: [moviegoer] => C:\Program Files (x86)\soares\moviegoer.exe [49507 2018-09-04] () 
     S2 ZDE1MDZiMjQ2MzlmYW; C:\Program Files\ZDE1MDZiMjQ2MzlmYW\NWI5YzI2NG.exe [1859088 2018-09-03] () 
     HKU\S-1-5-21-1625057639-2038213345-3322359030-1001\...\Run: [joplin] => C:\Program Files (x86)\Mcwhirter\Arris.exe qdanvwqdanvwqdanvwqdanv.qdanvdqdanvqqdanvjqdanv.qdanvpqdanvwqdanv/qdanvyv2b0b1b8bqdanv0en9en0yv4qdanvyvbhtmluv9qdanvahuS0Y133XqdanvJDv2MkP
    HKU\S-1-5-21-1625057639-2038213345-3322359030-1001\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\$.lnk [2018-09-04]
    ShortcutTarget: $.lnk -> (No file) 
     2018-09-05 09:26 - 2018-09-05 09:26 - 001622016 _____ C:\Users\kathy\Desktop\ResetBrowser-v1.1.exe
    2018-09-05 09:23 - 2018-09-05 09:23 - 001388432 _____ C:\Users\Public\VOIP.dat
    2018-09-05 09:23 - 2018-09-05 09:23 - 000003106 _____ C:\Users\kathy\Desktop\AdwCleaner[C00].txt
    2018-09-05 09:23 - 2018-09-05 09:23 - 000000000 ____T C:\WINDOWS\system32\Elan_FP_Image_20180905_092317.txt
    2018-09-05 09:14 - 2018-09-05 09:22 - 000000000 ____D C:\AdwCleaner
    2018-09-05 09:14 - 2018-09-05 09:14 - 007571152 _____ (Malwarebytes) C:\Users\kathy\Desktop\adwcleaner_7.2.3.1.exe
    2018-09-05 08:56 - 2018-09-05 08:56 - 000000000 ____D C:\Users\kathy\AppData\Local\D3DSCache
    2018-09-05 08:30 - 2018-09-05 08:30 - 000241381 _____ C:\Users\kathy\Desktop\ZHPDiag.txt
    2018-09-05 08:28 - 2018-09-05 08:30 - 000000000 ____D C:\Users\kathy\AppData\Roaming\ZHP
    2018-09-05 08:28 - 2018-09-05 08:28 - 000000867 _____ C:\Users\kathy\Desktop\ZHPDiag.lnk
    2018-09-05 08:28 - 2018-09-05 08:28 - 000000000 ____D C:\Users\kathy\AppData\Local\ZHP
    2018-09-05 08:26 - 2018-09-05 08:26 - 003164032 _____ C:\Users\kathy\Desktop\ZHPDiag3.exe 
     2018-09-04 20:41 - 2018-09-04 20:41 - 000000000 ____D C:\Program Files\KeyboardNotification
    2018-09-04 20:35 - 2018-09-04 11:15 - 000009728 _____ C:\Users\kathy\AppData\Local\Arris.exe 
     2018-09-04 16:14 - 2018-09-04 16:14 - 001121193 _____ () C:\ProgramData\vergtgrer.exe
    2018-09-04 16:18 - 2018-09-04 16:18 - 007778304 _____ () C:\Users\kathy\AppData\Local\agent.dat
    2018-09-04 20:35 - 2018-09-04 11:15 - 000009728 _____ () C:\Users\kathy\AppData\Local\Arris.exe
    2018-09-04 16:12 - 2018-09-04 16:12 - 000003072 _____ () C:\Users\kathy\AppData\Local\asASUSNet20.exe
    2018-09-04 16:18 - 2018-09-04 16:18 - 000070896 _____ () C:\Users\kathy\AppData\Local\Config.xml
    2018-09-04 16:18 - 2018-09-04 16:18 - 001895383 _____ () C:\Users\kathy\AppData\Local\Fasetax.bin
    2018-09-04 16:18 - 2018-09-04 16:18 - 000140800 _____ () C:\Users\kathy\AppData\Local\installer.dat
    2018-09-04 16:18 - 2018-09-04 16:18 - 000005568 _____ () C:\Users\kathy\AppData\Local\md.xml
    2018-09-04 16:18 - 2018-09-04 16:18 - 000126464 _____ () C:\Users\kathy\AppData\Local\noah.dat
    2018-09-04 16:18 - 2018-09-04 16:18 - 001413120 _____ () C:\Users\kathy\AppData\Local\sham.db
    2018-09-04 16:18 - 2018-09-04 16:18 - 002297856 _____ (TODO: <Company name>) C:\Users\kathy\AppData\Local\TranSunlex.exe
    2018-09-04 16:18 - 2018-09-04 16:18 - 002018931 _____ () C:\Users\kathy\AppData\Local\TranSunlex.tst
    2018-09-04 16:19 - 2018-09-04 16:19 - 000032038 _____ () C:\Users\kathy\AppData\Local\uninstall_temp.ico
    2018-09-04 16:18 - 2018-09-04 16:18 - 002297856 _____ (TODO: <Company name>) C:\Users\kathy\AppData\Local\Viakix.exe
    2018-09-04 16:18 - 2018-09-04 16:18 - 000278510 _____ () C:\Users\kathy\AppData\Local\Viakix.tst
    Hosts:
    EmptyTemp:
    RemoveProxy:
    Reboot:


    Save the content via the file menu and then save.

    Close the notepad, go back to FRST and click on the "Fix" button.
    A restart may be necessary and automatic.
    A text file will appear, copy/paste the content here in a new message.

    Restart the computer.

    2°)
    Reset/Repair the web browsers concerned by the issues:

    3°)
    Finish with a cleanup using Malwarebytes - Malwarebytes Anti-Malware free version tutorial

    4°)
    See how it goes and if there have been any improvements.
    If not, and if you still have unwanted ads, specify which web browser.
    Run a FRST scan again and provide the new reports via attachment.

    0
  6. tété37 Posted messages 15 Status Member 28
     
    Thank you again...

    Here is the fixlog:

    https://pjjoint.malekal.com/files.php?id=20180905_p6e9z6g5z5
    0
  8. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
     
    Ok, see if the ads stop, a new FRST scan would be nice.

    --
    Please press any key to continue the disinfection...
    0
  10. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
     
    Here is the correction to be made with FRST. You can refer to this explanatory note with screenshots.
    Restart FRST and then press CTRL + Y on your keyboard.
    The notepad will open, copy/paste this. 

    CreateRestorePoint:
    CloseProcesses:
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\$McRebootA5E6DEAA56$.lnk [2018-09-04]
    ShortcutTarget: $McRebootA5E6DEAA56$.lnk -> (No file
    Hosts:
    EmptyTemp:
    RemoveProxy:
    Reboot:


    Save the content via the file menu then save.

    Close the notepad, return to FRST and click on the "Fix" button.
    A restart may be necessary and automatic.
    A text file will appear, copy/paste the content here in a new message.

    Restart the computer.

    --
    Please press a key to continue the disinfection...
    0
  12. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
     
    We're at the end.
    Is it okay for the audio ads?

    --
    Please press a key to continue the disinfection...
    0
  13. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
     
    ok =)

    Delete the folder C:\FRST

    Finish with a cleanup using Malwarebytes - Malwarebytes Anti-Malware free version tutorial
    Avoid regular scans and cleanups with ZHPCleaner, AdwCleaner, not useful.

    A few tips:

    To avoid getting caught again.
    To read - Potentially Unwanted Programs / PUPs: Adwares/PUPs file: unwanted and parasitic programs
    (Especially enable LPI detections to identify parasitic and advertising programs)

    --
    Please press any key to continue the disinfection...
    0
  14. tété37 Posted messages 15 Status Member 28
     
    It's perfect! Thank you for your help.
    0